ClosedPatched

Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

Oracle E-Business Suite

Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

Why this severity: Unauthenticated RCE zero-day; mass data theft and extortion; CISA KEV; known ransomware use

Started: Sep 29, 2025
Closed: Oct 20, 2025
CVE: CVE-2025-61882

Follow this incident

Updated Oct 20, 2025

Affected

Oracle E-Business Suite 12.2.3 to 12.2.14

Fixed in

Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)

Timeline4

Oct 20, 2025
CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV
Source
Oct 6, 2025
CISA adds CVE-2025-61882 to KEV
Oct 4, 2025
Oracle publishes a Security Alert for CVE-2025-61882
Source
Sep 29, 2025
Cl0p-branded extortion emails start arriving at executives
Source

Advisories3

News & write-ups3

Notes & caveats

Oracle alert Rev 1 was released 2025-10-04 (CVSS 9.8; credits CrowdStrike and Mandiant). CVE-2025-61884 has its own KEV entry.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified